Virus

Primary: Antivirus software (designed exactly for this)
Secondary: Firewall (can block infected files coming in), User behavior (don't open unknown attachments)
Note: Auditing software can detect unusual activity caused by a virus after the fact

Worm

Primary: Firewall (can block the self-propagating traffic), Antivirus software
Secondary: Security updates / patching (worms often exploit known vulnerabilities — the reading mentions this)
Note: User behavior matters less here since worms spread without user action — that's a meaningful distinction worth surfacing

Trojan Horse

Primary: User behavior (the user has to willingly install it — this is the most important defense), Antivirus software (if it recognizes the signature)
Secondary: Spam filter (Trojans often arrive as email attachments)
Note: A firewall won't help much — the user is inviting it in

Spyware

Primary: Antivirus software (many products specialize in spyware specifically), Firewall (can block the clandestine server spyware uses to send data out — the reading makes this point explicitly)
Secondary: Proxy server (hides internal network details that spyware might report)
Note: This is one where the reading gives a specific and somewhat surprising answer about firewalls — worth highlighting

Phishing

Primary: User behavior (the only truly reliable defense — no software stops a determined user from entering their own password)
Secondary: Spam filter (can block phishing emails before they arrive)
Note: This is the "at least one threat is best stopped by something that isn't software" answer on the projection. Firewall does NOT reliably stop it. Antivirus doesn't prevent it, only catches attachments after the fact.

DoS / DDoS

Primary: Firewall (can block traffic from known attacking addresses — the reading says this explicitly)
Secondary: Auditing software (detects the anomalous traffic spike early, before it becomes catastrophic)
Note: No defense fully prevents a large DDoS — the distributed nature is designed to overwhelm any single point of defense. This is worth naming honestly.

Spam

Primary: Spam filter (purpose-built for exactly this)
Secondary: User behavior (not clicking links or attachments in spam)
Note: Spam is somewhat the odd one out — it's less a direct attack than a delivery mechanism for other attacks. The reading frames it this way.

Additional Notes

• Encryption appears on the defense list but doesn't map cleanly to any of the seven threats — it protects data in transit from being read if intercepted, which is more relevant to the cryptography section than to malware. Students may struggle to connect it to any specific threat, and that's fine — it's a legitimate observation that encryption is a different category of defense.
• Proxy server is the hardest one to place. The reading connects it most directly to spyware-style data harvesting and protecting internal network structure from external servers. Students are unlikely to get this without prompting.
• Auditing software is underappreciated — it's the early warning system that cuts across almost everything, but it doesn't prevent any single threat on its own.